

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

    <title>saml2.response &mdash; SAML Python library classes and methods</title>

    <link rel="stylesheet" href="../../_static/default.css" type="text/css" />
    <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

    <script type="text/javascript">
      var DOCUMENTATION_OPTIONS = {
        URL_ROOT:    '../../',
        VERSION:     '',
        COLLAPSE_INDEX: false,
        FILE_SUFFIX: '.html',
        HAS_SOURCE:  true
      };
    </script>
    <script type="text/javascript" src="../../_static/jquery.js"></script>
    <script type="text/javascript" src="../../_static/underscore.js"></script>
    <script type="text/javascript" src="../../_static/doctools.js"></script>
    <link rel="top" title="SAML Python library classes and methods" href="../../index.html" />
    <link rel="up" title="Class code" href="../index.html" />
  </head>
  <body>
    <div class="related">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../../genindex.html" title="General Index"
             accesskey="I">index</a></li>
        <li class="right" >
          <a href="../../py-modindex.html" title="Python Class Index"
             >modules</a> |</li>
        <li><a href="../../index.html">SAML Python library classes and methods</a> &raquo;</li>
          <li><a href="../index.html" accesskey="U">Class code</a> &raquo;</li>
      </ul>
    </div>

    <div class="document">
      <div class="documentwrapper">
        <div class="bodywrapper">
          <div class="body">

  <h1>Source code for saml2.response</h1><div class="highlight"><pre>
<span class="c"># -*- coding: utf-8 -*-</span>


<span class="kn">from</span> <span class="nn">base64</span> <span class="kn">import</span> <span class="n">b64decode</span>
<span class="kn">from</span> <span class="nn">copy</span> <span class="kn">import</span> <span class="n">deepcopy</span>
<span class="kn">from</span> <span class="nn">lxml</span> <span class="kn">import</span> <span class="n">etree</span>
<span class="kn">from</span> <span class="nn">os.path</span> <span class="kn">import</span> <span class="n">basename</span>
<span class="kn">from</span> <span class="nn">time</span> <span class="kn">import</span> <span class="n">time</span>
<span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">from</span> <span class="nn">xml.dom.minidom</span> <span class="kn">import</span> <span class="n">Document</span>

<span class="kn">import</span> <span class="nn">dm.xmlsec.binding</span> <span class="kn">as</span> <span class="nn">xmlsec</span>

<span class="kn">from</span> <span class="nn">saml2.constants</span> <span class="kn">import</span> <span class="n">OneLogin_Saml2_Constants</span>
<span class="kn">from</span> <span class="nn">saml2.utils</span> <span class="kn">import</span> <span class="n">OneLogin_Saml2_Utils</span>


<div class="viewcode-block" id="OneLogin_Saml2_Response"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response">[docs]</a><span class="k">class</span> <span class="nc">OneLogin_Saml2_Response</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>

    <span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">settings</span><span class="p">,</span> <span class="n">response</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Constructs the response object.</span>

<span class="sd">        :param settings: The setting info</span>
<span class="sd">        :type settings: OneLogin_Saml2_Setting object</span>

<span class="sd">        :param response: The base64 encoded, XML string containing the samlp:Response</span>
<span class="sd">        :type response: string</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span> <span class="o">=</span> <span class="n">settings</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">response</span> <span class="o">=</span> <span class="n">b64decode</span><span class="p">(</span><span class="n">response</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">document</span> <span class="o">=</span> <span class="n">etree</span><span class="o">.</span><span class="n">fromstring</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">response</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">decrypted_document</span> <span class="o">=</span> <span class="bp">None</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">encrypted</span> <span class="o">=</span> <span class="bp">None</span>

        <span class="c"># Quick check for the presence of EncryptedAssertion</span>
        <span class="n">encrypted_assertion_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="s">&#39;//saml:EncryptedAssertion&#39;</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">encrypted_assertion_nodes</span><span class="p">:</span>
            <span class="n">decrypted_document</span> <span class="o">=</span> <span class="n">deepcopy</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">document</span><span class="p">)</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">encrypted</span> <span class="o">=</span> <span class="bp">True</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">decrypted_document</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__decrypt_assertion</span><span class="p">(</span><span class="n">decrypted_document</span><span class="p">)</span>

<div class="viewcode-block" id="OneLogin_Saml2_Response.is_valid"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.is_valid">[docs]</a>    <span class="k">def</span> <span class="nf">is_valid</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">request_data</span><span class="p">,</span> <span class="n">request_id</span><span class="o">=</span><span class="bp">None</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Constructs the response object.</span>

<span class="sd">        :param request_id: Optional argument. The ID of the AuthNRequest sent by this SP to the IdP</span>
<span class="sd">        :type request_id: string</span>

<span class="sd">        :returns: True if the SAML Response is valid, False if not</span>
<span class="sd">        :rtype: bool</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">try</span><span class="p">:</span>
            <span class="c"># Checks SAML version</span>
            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">document</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;Version&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span> <span class="o">!=</span> <span class="s">&#39;2.0&#39;</span><span class="p">:</span>
                <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Unsupported SAML version&#39;</span><span class="p">)</span>

            <span class="c"># Checks that ID exists</span>
            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">document</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;ID&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span> <span class="ow">is</span> <span class="bp">None</span><span class="p">:</span>
                <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Missing ID attribute on SAML Response&#39;</span><span class="p">)</span>

            <span class="c"># Checks that the response only has one assertion</span>
            <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">validate_num_assertions</span><span class="p">():</span>
                <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Multiple assertions are not supported&#39;</span><span class="p">)</span>

            <span class="c"># Checks that the response has the SUCCESS status</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">check_status</span><span class="p">()</span>

            <span class="n">idp_data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">get_idp_data</span><span class="p">()</span>
            <span class="n">idp_entityid</span> <span class="o">=</span> <span class="n">idp_data</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;entityId&#39;</span><span class="p">,</span> <span class="s">&#39;&#39;</span><span class="p">)</span>
            <span class="n">sp_data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">get_sp_data</span><span class="p">()</span>
            <span class="n">sp_entityid</span> <span class="o">=</span> <span class="n">sp_data</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;entityId&#39;</span><span class="p">,</span> <span class="s">&#39;&#39;</span><span class="p">)</span>

            <span class="n">sign_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="s">&#39;//ds:Signature&#39;</span><span class="p">)</span>

            <span class="n">signed_elements</span> <span class="o">=</span> <span class="p">[]</span>
            <span class="k">for</span> <span class="n">sign_node</span> <span class="ow">in</span> <span class="n">sign_nodes</span><span class="p">:</span>
                <span class="n">signed_elements</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">sign_node</span><span class="o">.</span><span class="n">getparent</span><span class="p">()</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>

            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">is_strict</span><span class="p">():</span>
                <span class="n">res</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">validate_xml</span><span class="p">(</span><span class="n">etree</span><span class="o">.</span><span class="n">tostring</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">document</span><span class="p">),</span> <span class="s">&#39;saml-schema-protocol-2.0.xsd&#39;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">is_debug_active</span><span class="p">())</span>
                <span class="k">if</span> <span class="ow">not</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">res</span><span class="p">,</span> <span class="n">Document</span><span class="p">):</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd&#39;</span><span class="p">)</span>

                <span class="n">security</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">get_security_data</span><span class="p">()</span>
                <span class="n">current_url</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">get_self_url_no_query</span><span class="p">(</span><span class="n">request_data</span><span class="p">)</span>

                <span class="c"># Check if the InResponseTo of the Response matchs the ID of the AuthNRequest (requestId) if provided</span>
                <span class="n">in_response_to</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">document</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;InResponseTo&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                <span class="k">if</span> <span class="n">in_response_to</span> <span class="ow">and</span> <span class="n">request_id</span><span class="p">:</span>
                    <span class="k">if</span> <span class="n">in_response_to</span> <span class="o">!=</span> <span class="n">request_id</span><span class="p">:</span>
                        <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;The InResponseTo of the Response: </span><span class="si">%s</span><span class="s">, does not match the ID of the AuthNRequest sent by the SP: </span><span class="si">%s</span><span class="s">&#39;</span> <span class="o">%</span> <span class="p">(</span><span class="n">in_response_to</span><span class="p">,</span> <span class="n">request_id</span><span class="p">))</span>

                <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">encrypted</span> <span class="ow">and</span> <span class="n">security</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;wantAssertionsEncrypted&#39;</span><span class="p">,</span> <span class="bp">False</span><span class="p">):</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;The assertion of the Response is not encrypted and the SP require it&#39;</span><span class="p">)</span>

                <span class="k">if</span> <span class="n">security</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;wantNameIdEncrypted&#39;</span><span class="p">,</span> <span class="bp">False</span><span class="p">):</span>
                    <span class="n">encrypted_nameid_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:Subject/saml:EncryptedID/xenc:EncryptedData&#39;</span><span class="p">)</span>
                    <span class="k">if</span> <span class="ow">not</span> <span class="n">encrypted_nameid_nodes</span><span class="p">:</span>
                        <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;The NameID of the Response is not encrypted and the SP require it&#39;</span><span class="p">)</span>

                <span class="c"># Checks that there is at least one AttributeStatement</span>
                <span class="n">attribute_statement_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:AttributeStatement&#39;</span><span class="p">)</span>
                <span class="k">if</span> <span class="ow">not</span> <span class="n">attribute_statement_nodes</span><span class="p">:</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;There is no AttributeStatement on the Response&#39;</span><span class="p">)</span>

                <span class="c"># Validates Asserion timestamps</span>
                <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">validate_timestamps</span><span class="p">():</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Timing issues (please check your clock settings)&#39;</span><span class="p">)</span>

                <span class="n">encrypted_attributes_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:AttributeStatement/saml:EncryptedAttribute&#39;</span><span class="p">)</span>
                <span class="k">if</span> <span class="n">encrypted_attributes_nodes</span><span class="p">:</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;There is an EncryptedAttribute in the Response and this SP not support them&#39;</span><span class="p">)</span>

                <span class="c"># Checks destination</span>
                <span class="n">destination</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">document</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;Destination&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                <span class="k">if</span> <span class="n">destination</span><span class="p">:</span>
                    <span class="k">if</span> <span class="n">destination</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">current_url</span><span class="p">:</span>
                        <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;The response was received at </span><span class="si">%s</span><span class="s"> instead of </span><span class="si">%s</span><span class="s">&#39;</span> <span class="o">%</span> <span class="p">(</span><span class="n">current_url</span><span class="p">,</span> <span class="n">destination</span><span class="p">))</span>

                <span class="c"># Checks audience</span>
                <span class="n">valid_audiences</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_audiences</span><span class="p">()</span>
                <span class="k">if</span> <span class="n">valid_audiences</span> <span class="ow">and</span> <span class="n">sp_entityid</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">valid_audiences</span><span class="p">:</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;</span><span class="si">%s</span><span class="s"> is not a valid audience for this Response&#39;</span> <span class="o">%</span> <span class="n">sp_entityid</span><span class="p">)</span>

                <span class="c"># Checks the issuers</span>
                <span class="n">issuers</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_issuers</span><span class="p">()</span>
                <span class="k">for</span> <span class="n">issuer</span> <span class="ow">in</span> <span class="n">issuers</span><span class="p">:</span>
                    <span class="k">if</span> <span class="ow">not</span> <span class="n">issuer</span> <span class="ow">or</span> <span class="n">issuer</span> <span class="o">!=</span> <span class="n">idp_entityid</span><span class="p">:</span>
                        <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Invalid issuer in the Assertion/Response&#39;</span><span class="p">)</span>

                <span class="c"># Checks the session Expiration</span>
                <span class="n">session_expiration</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_session_not_on_or_after</span><span class="p">()</span>
                <span class="k">if</span> <span class="ow">not</span> <span class="n">session_expiration</span> <span class="ow">and</span> <span class="n">session_expiration</span> <span class="o">&lt;=</span> <span class="n">time</span><span class="p">():</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;The attributes have expired, based on the SessionNotOnOrAfter of the AttributeStatement of this Response&#39;</span><span class="p">)</span>

                <span class="c"># Checks the SubjectConfirmation, at least one SubjectConfirmation must be valid</span>
                <span class="n">any_subject_confirmation</span> <span class="o">=</span> <span class="bp">False</span>
                <span class="n">subject_confirmation_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:Subject/saml:SubjectConfirmation&#39;</span><span class="p">)</span>

                <span class="k">for</span> <span class="n">scn</span> <span class="ow">in</span> <span class="n">subject_confirmation_nodes</span><span class="p">:</span>
                    <span class="n">method</span> <span class="o">=</span> <span class="n">scn</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;Method&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                    <span class="k">if</span> <span class="n">method</span> <span class="ow">and</span> <span class="n">method</span> <span class="o">!=</span> <span class="n">OneLogin_Saml2_Constants</span><span class="o">.</span><span class="n">CM_BEARER</span><span class="p">:</span>
                        <span class="k">continue</span>
                    <span class="n">scData</span> <span class="o">=</span> <span class="n">scn</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="s">&#39;saml:SubjectConfirmationData&#39;</span><span class="p">,</span> <span class="n">namespaces</span><span class="o">=</span><span class="n">OneLogin_Saml2_Constants</span><span class="o">.</span><span class="n">NSMAP</span><span class="p">)</span>
                    <span class="k">if</span> <span class="n">scData</span> <span class="ow">is</span> <span class="bp">None</span><span class="p">:</span>
                        <span class="k">continue</span>
                    <span class="k">else</span><span class="p">:</span>
                        <span class="n">irt</span> <span class="o">=</span> <span class="n">scData</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;InResponseTo&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                        <span class="k">if</span> <span class="n">irt</span> <span class="o">!=</span> <span class="n">in_response_to</span><span class="p">:</span>
                            <span class="k">continue</span>
                        <span class="n">recipient</span> <span class="o">=</span> <span class="n">scData</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;Recipient&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                        <span class="k">if</span> <span class="n">recipient</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">current_url</span><span class="p">:</span>
                            <span class="k">continue</span>
                        <span class="n">nooa</span> <span class="o">=</span> <span class="n">scData</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;NotOnOrAfter&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                        <span class="k">if</span> <span class="n">nooa</span><span class="p">:</span>
                            <span class="n">parsed_nooa</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">parse_SAML_to_time</span><span class="p">(</span><span class="n">nooa</span><span class="p">)</span>
                            <span class="k">if</span> <span class="n">parsed_nooa</span> <span class="o">&lt;=</span> <span class="n">time</span><span class="p">():</span>
                                <span class="k">continue</span>
                        <span class="n">nb</span> <span class="o">=</span> <span class="n">scData</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;NotBefore&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                        <span class="k">if</span> <span class="n">nb</span><span class="p">:</span>
                            <span class="n">parsed_nb</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">parse_SAML_to_time</span><span class="p">(</span><span class="n">nb</span><span class="p">)</span>
                            <span class="k">if</span> <span class="p">(</span><span class="n">parsed_nb</span> <span class="o">&gt;</span> <span class="n">time</span><span class="p">()):</span>
                                <span class="k">continue</span>
                        <span class="n">any_subject_confirmation</span> <span class="o">=</span> <span class="bp">True</span>
                        <span class="k">break</span>

                <span class="k">if</span> <span class="ow">not</span> <span class="n">any_subject_confirmation</span><span class="p">:</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;A valid SubjectConfirmation was not found on this Response&#39;</span><span class="p">)</span>

                <span class="k">if</span> <span class="n">security</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;wantAssertionsSigned&#39;</span><span class="p">,</span> <span class="bp">False</span><span class="p">)</span> <span class="ow">and</span> <span class="s">&#39;saml:Assertion&#39;</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">signed_elements</span><span class="p">:</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;The Assertion of the Response is not signed and the SP require it&#39;</span><span class="p">)</span>

                <span class="k">if</span> <span class="n">security</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;wantMessagesSigned&#39;</span><span class="p">,</span> <span class="bp">False</span><span class="p">)</span> <span class="ow">and</span> <span class="s">&#39;samlp:Response&#39;</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">signed_elements</span><span class="p">:</span>
                    <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;The Message of the Response is not signed and the SP require it&#39;</span><span class="p">)</span>

                <span class="n">document_to_validate</span> <span class="o">=</span> <span class="bp">None</span>
                <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">signed_elements</span><span class="p">)</span> <span class="o">&gt;</span> <span class="mi">0</span><span class="p">:</span>
                    <span class="n">cert</span> <span class="o">=</span> <span class="n">idp_data</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;x509cert&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
                    <span class="n">fingerprint</span> <span class="o">=</span> <span class="n">idp_data</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;certFingerprint&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>

                    <span class="c"># Only validates the first sign found</span>
                    <span class="k">if</span> <span class="s">&#39;samlp:Response&#39;</span> <span class="ow">in</span> <span class="n">signed_elements</span><span class="p">:</span>
                        <span class="n">document_to_validate</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">document</span>
                    <span class="k">else</span><span class="p">:</span>
                        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">encrypted</span><span class="p">:</span>
                            <span class="n">document_to_validate</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">decrypted_document</span>
                        <span class="k">else</span><span class="p">:</span>
                            <span class="n">document_to_validate</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">document</span>

                <span class="k">if</span> <span class="n">document_to_validate</span> <span class="ow">is</span> <span class="ow">not</span> <span class="bp">None</span><span class="p">:</span>
                    <span class="k">if</span> <span class="ow">not</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">validate_sign</span><span class="p">(</span><span class="n">document_to_validate</span><span class="p">,</span> <span class="n">cert</span><span class="p">,</span> <span class="n">fingerprint</span><span class="p">):</span>
                        <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Signature validation failed. SAML Response rejected&#39;</span><span class="p">)</span>
            <span class="k">return</span> <span class="bp">True</span>
        <span class="k">except</span><span class="p">:</span>
            <span class="n">debug</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">is_debug_active</span><span class="p">()</span>
            <span class="k">if</span> <span class="n">debug</span><span class="p">:</span>
                <span class="k">print</span> <span class="n">sys</span><span class="o">.</span><span class="n">exc_info</span><span class="p">()[</span><span class="mi">0</span><span class="p">]</span>
            <span class="k">return</span> <span class="bp">False</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.check_status"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.check_status">[docs]</a>    <span class="k">def</span> <span class="nf">check_status</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Check if the status of the response is success or not</span>

<span class="sd">        :raises: Exception. If the status is not success</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">status</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">get_status</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">document</span><span class="p">)</span>
        <span class="n">code</span> <span class="o">=</span> <span class="n">status</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;code&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">code</span> <span class="ow">and</span> <span class="n">code</span> <span class="o">!=</span> <span class="n">OneLogin_Saml2_Constants</span><span class="o">.</span><span class="n">STATUS_SUCCESS</span><span class="p">:</span>
            <span class="n">splited_code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s">&#39;:&#39;</span><span class="p">)</span>
            <span class="n">printable_code</span> <span class="o">=</span> <span class="n">splited_code</span><span class="o">.</span><span class="n">pop</span><span class="p">()</span>
            <span class="n">status_exception_msg</span> <span class="o">=</span> <span class="s">&#39;The status code of the Response was not Success, was </span><span class="si">%s</span><span class="s">&#39;</span> <span class="o">%</span> <span class="n">printable_code</span>
            <span class="n">status_msg</span> <span class="o">=</span> <span class="n">status</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;msg&#39;</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
            <span class="k">if</span> <span class="n">status_msg</span><span class="p">:</span>
                <span class="n">status_exception_msg</span> <span class="o">+=</span> <span class="s">&#39; -&gt; &#39;</span> <span class="o">+</span> <span class="n">status_msg</span>
            <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="n">status_exception_msg</span><span class="p">)</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.get_audiences"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.get_audiences">[docs]</a>    <span class="k">def</span> <span class="nf">get_audiences</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Gets the audiences</span>

<span class="sd">        :returns: The valid audiences for the SAML Response</span>
<span class="sd">        :rtype: list</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">audiences</span> <span class="o">=</span> <span class="p">[]</span>

        <span class="n">audience_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:Conditions/saml:AudienceRestriction/saml:Audience&#39;</span><span class="p">)</span>
        <span class="k">for</span> <span class="n">audience_node</span> <span class="ow">in</span> <span class="n">audience_nodes</span><span class="p">:</span>
            <span class="n">audiences</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">audience_node</span><span class="o">.</span><span class="n">text</span><span class="p">)</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.get_issuers"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.get_issuers">[docs]</a>    <span class="k">def</span> <span class="nf">get_issuers</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Gets the issuers (from message and from assertion)</span>

<span class="sd">        :returns: The issuers</span>
<span class="sd">        :rtype: list</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">issuers</span> <span class="o">=</span> <span class="p">[]</span>

        <span class="n">message_issuer_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="s">&#39;/samlp:Response/saml:Issuer&#39;</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">message_issuer_nodes</span><span class="p">:</span>
            <span class="n">issuers</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">message_issuer_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">text</span><span class="p">)</span>

        <span class="n">assertion_issuer_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:Issuer&#39;</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">assertion_issuer_nodes</span><span class="p">:</span>
            <span class="n">issuers</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">assertion_issuer_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">text</span><span class="p">)</span>

        <span class="k">return</span> <span class="nb">list</span><span class="p">(</span><span class="nb">set</span><span class="p">(</span><span class="n">issuers</span><span class="p">))</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.get_nameid_data"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.get_nameid_data">[docs]</a>    <span class="k">def</span> <span class="nf">get_nameid_data</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Gets the NameID Data provided by the SAML Response from the IdP</span>

<span class="sd">        :returns: Name ID Data (Value, Format, NameQualifier, SPNameQualifier)</span>
<span class="sd">        :rtype: dict</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">nameid</span> <span class="o">=</span> <span class="bp">None</span>
        <span class="n">encrypted_id_data_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:Subject/saml:EncryptedID/xenc:EncryptedData&#39;</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">encrypted_id_data_nodes</span><span class="p">:</span>
            <span class="n">encrypted_data</span> <span class="o">=</span> <span class="n">encrypted_id_data_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>

            <span class="n">xmlsec</span><span class="o">.</span><span class="n">initialize</span><span class="p">()</span>

            <span class="c"># Load the key into the xmlsec context</span>
            <span class="n">key</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">get_sp_key</span><span class="p">()</span>
            <span class="n">file_key</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">write_temp_file</span><span class="p">(</span><span class="n">key</span><span class="p">)</span>  <span class="c"># FIXME avoid writing a file</span>
            <span class="n">enc_key</span> <span class="o">=</span> <span class="n">xmlsec</span><span class="o">.</span><span class="n">Key</span><span class="o">.</span><span class="n">load</span><span class="p">(</span><span class="n">file_key</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="n">xmlsec</span><span class="o">.</span><span class="n">KeyDataFormatPem</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
            <span class="n">enc_key</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="n">basename</span><span class="p">(</span><span class="n">file_key</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
            <span class="n">file_key</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
            <span class="n">enc_ctx</span> <span class="o">=</span> <span class="n">xmlsec</span><span class="o">.</span><span class="n">EncCtx</span><span class="p">()</span>
            <span class="n">enc_ctx</span><span class="o">.</span><span class="n">encKey</span> <span class="o">=</span> <span class="n">enc_key</span>

            <span class="n">nameid</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">decrypt_element</span><span class="p">(</span><span class="n">encrypted_data</span><span class="p">,</span> <span class="n">enc_ctx</span><span class="p">)</span>
        <span class="k">else</span><span class="p">:</span>
            <span class="n">nameid_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:Subject/saml:NameID&#39;</span><span class="p">)</span>
            <span class="k">if</span> <span class="n">nameid_nodes</span><span class="p">:</span>
                <span class="n">nameid</span> <span class="o">=</span> <span class="n">nameid_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
        <span class="k">if</span> <span class="n">nameid</span> <span class="ow">is</span> <span class="bp">None</span><span class="p">:</span>
            <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;Not NameID found in the assertion of the Response&#39;</span><span class="p">)</span>

        <span class="n">nameid_data</span> <span class="o">=</span> <span class="p">{</span><span class="s">&#39;Value&#39;</span><span class="p">:</span> <span class="n">nameid</span><span class="o">.</span><span class="n">text</span><span class="p">}</span>
        <span class="k">for</span> <span class="n">attr</span> <span class="ow">in</span> <span class="p">[</span><span class="s">&#39;Format&#39;</span><span class="p">,</span> <span class="s">&#39;SPNameQualifier&#39;</span><span class="p">,</span> <span class="s">&#39;NameQualifier&#39;</span><span class="p">]:</span>
            <span class="n">value</span> <span class="o">=</span> <span class="n">nameid</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">attr</span><span class="p">,</span> <span class="bp">None</span><span class="p">)</span>
            <span class="k">if</span> <span class="n">value</span><span class="p">:</span>
                <span class="n">nameid_data</span><span class="p">[</span><span class="n">attr</span><span class="p">]</span> <span class="o">=</span> <span class="n">value</span>
        <span class="k">return</span> <span class="n">nameid_data</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.get_nameid"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.get_nameid">[docs]</a>    <span class="k">def</span> <span class="nf">get_nameid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Gets the NameID provided by the SAML Response from the IdP</span>

<span class="sd">        :returns: NameID (value)</span>
<span class="sd">        :rtype: string</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">nameid_data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_nameid_data</span><span class="p">()</span>
        <span class="k">return</span> <span class="n">nameid_data</span><span class="p">[</span><span class="s">&#39;Value&#39;</span><span class="p">]</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.get_session_not_on_or_after"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.get_session_not_on_or_after">[docs]</a>    <span class="k">def</span> <span class="nf">get_session_not_on_or_after</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Gets the SessionNotOnOrAfter from the AuthnStatement</span>
<span class="sd">        Could be used to set the local session expiration</span>

<span class="sd">        :returns: The SessionNotOnOrAfter value</span>
<span class="sd">        :rtype: time|None</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">not_on_or_after</span> <span class="o">=</span> <span class="bp">None</span>
        <span class="n">authn_statement_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:AuthnStatement[@SessionNotOnOrAfter]&#39;</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">authn_statement_nodes</span><span class="p">:</span>
            <span class="n">not_on_or_after</span> <span class="o">=</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">parse_SAML_to_time</span><span class="p">(</span><span class="n">authn_statement_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;SessionNotOnOrAfter&#39;</span><span class="p">))</span>
        <span class="k">return</span> <span class="n">not_on_or_after</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.get_session_index"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.get_session_index">[docs]</a>    <span class="k">def</span> <span class="nf">get_session_index</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Gets the SessionIndex from the AuthnStatement</span>
<span class="sd">        Could be used to be stored in the local session in order</span>
<span class="sd">        to be used in a future Logout Request that the SP could</span>
<span class="sd">        send to the SP, to set what specific session must be deleted</span>

<span class="sd">        :returns: The SessionIndex value</span>
<span class="sd">        :rtype: string|None</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">session_index</span> <span class="o">=</span> <span class="bp">None</span>
        <span class="n">authn_statement_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:AuthnStatement[@SessionIndex]&#39;</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">authn_statement_nodes</span><span class="p">:</span>
            <span class="n">session_index</span> <span class="o">=</span> <span class="n">authn_statement_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;SessionIndex&#39;</span><span class="p">)</span>
        <span class="k">return</span> <span class="n">session_index</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.get_attributes"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.get_attributes">[docs]</a>    <span class="k">def</span> <span class="nf">get_attributes</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Gets the Attributes from the AttributeStatement element.</span>
<span class="sd">        EncryptedAttributes are not supported</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">attributes</span> <span class="o">=</span> <span class="p">{}</span>
        <span class="n">attribute_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query_assertion</span><span class="p">(</span><span class="s">&#39;/saml:AttributeStatement/saml:Attribute&#39;</span><span class="p">)</span>
        <span class="k">for</span> <span class="n">attribute_node</span> <span class="ow">in</span> <span class="n">attribute_nodes</span><span class="p">:</span>
            <span class="n">attr_name</span> <span class="o">=</span> <span class="n">attribute_node</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;Name&#39;</span><span class="p">)</span>
            <span class="n">values</span> <span class="o">=</span> <span class="p">[]</span>
            <span class="k">for</span> <span class="n">attr</span> <span class="ow">in</span> <span class="n">attribute_node</span><span class="o">.</span><span class="n">iterchildren</span><span class="p">(</span><span class="s">&#39;{</span><span class="si">%s</span><span class="s">}AttributeValue&#39;</span> <span class="o">%</span> <span class="n">OneLogin_Saml2_Constants</span><span class="o">.</span><span class="n">NSMAP</span><span class="p">[</span><span class="s">&#39;saml&#39;</span><span class="p">]):</span>
                <span class="n">values</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">attr</span><span class="o">.</span><span class="n">text</span><span class="p">)</span>
            <span class="n">attributes</span><span class="p">[</span><span class="n">attr_name</span><span class="p">]</span> <span class="o">=</span> <span class="n">values</span>
        <span class="k">return</span> <span class="n">attributes</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.validate_num_assertions"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.validate_num_assertions">[docs]</a>    <span class="k">def</span> <span class="nf">validate_num_assertions</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Verifies that the document only contains a single Assertion (encrypted or not)</span>

<span class="sd">        :returns: True if only 1 assertion encrypted or not</span>
<span class="sd">        :rtype: bool</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">encrypted_assertion_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="s">&#39;//saml:EncryptedAssertion&#39;</span><span class="p">)</span>
        <span class="n">assertion_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="s">&#39;//saml:Assertion&#39;</span><span class="p">)</span>
        <span class="k">return</span> <span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">encrypted_assertion_nodes</span><span class="p">)</span> <span class="o">+</span> <span class="nb">len</span><span class="p">(</span><span class="n">assertion_nodes</span><span class="p">))</span> <span class="o">==</span> <span class="mi">1</span>
</div>
<div class="viewcode-block" id="OneLogin_Saml2_Response.validate_timestamps"><a class="viewcode-back" href="../../saml2.html#saml2.response.OneLogin_Saml2_Response.validate_timestamps">[docs]</a>    <span class="k">def</span> <span class="nf">validate_timestamps</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Verifies that the document is valid according to Conditions Element</span>

<span class="sd">        :returns: True if the condition is valid, False otherwise</span>
<span class="sd">        :rtype: bool</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">conditions_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="s">&#39;//saml:Conditions&#39;</span><span class="p">)</span>
        <span class="k">for</span> <span class="n">conditions_node</span> <span class="ow">in</span> <span class="n">conditions_nodes</span><span class="p">:</span>
            <span class="n">nb_attr</span> <span class="o">=</span> <span class="n">conditions_node</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;NotBefore&#39;</span><span class="p">)</span>
            <span class="n">nooa_attr</span> <span class="o">=</span> <span class="n">conditions_node</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;NotOnOrAfter&#39;</span><span class="p">)</span>
            <span class="k">if</span> <span class="n">nb_attr</span> <span class="ow">and</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">parse_SAML_to_time</span><span class="p">(</span><span class="n">nb_attr</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">time</span><span class="p">()</span> <span class="o">+</span> <span class="n">OneLogin_Saml2_Constants</span><span class="o">.</span><span class="n">ALOWED_CLOCK_DRIFT</span><span class="p">:</span>
                <span class="k">return</span> <span class="bp">False</span>
            <span class="k">if</span> <span class="n">nooa_attr</span> <span class="ow">and</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">parse_SAML_to_time</span><span class="p">(</span><span class="n">nooa_attr</span><span class="p">)</span> <span class="o">+</span> <span class="n">OneLogin_Saml2_Constants</span><span class="o">.</span><span class="n">ALOWED_CLOCK_DRIFT</span> <span class="o">&lt;=</span> <span class="n">time</span><span class="p">():</span>
                <span class="k">return</span> <span class="bp">False</span>
        <span class="k">return</span> <span class="bp">True</span>
</div>
    <span class="k">def</span> <span class="nf">__query_assertion</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">xpath_expr</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Extracts nodes that match the query from the Assertion</span>

<span class="sd">        :param query: Xpath Expresion</span>
<span class="sd">        :type query: String</span>

<span class="sd">        :returns: The queried nodes</span>
<span class="sd">        :rtype: list</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">encrypted</span><span class="p">:</span>
            <span class="n">assertion_expr</span> <span class="o">=</span> <span class="s">&#39;/saml:EncryptedAssertion/saml:Assertion&#39;</span>
        <span class="k">else</span><span class="p">:</span>
            <span class="n">assertion_expr</span> <span class="o">=</span> <span class="s">&#39;/saml:Assertion&#39;</span>
        <span class="n">signature_expr</span> <span class="o">=</span> <span class="s">&#39;/ds:Signature/ds:SignedInfo/ds:Reference&#39;</span>
        <span class="n">signed_assertion_query</span> <span class="o">=</span> <span class="s">&#39;/samlp:Response&#39;</span> <span class="o">+</span> <span class="n">assertion_expr</span> <span class="o">+</span> <span class="n">signature_expr</span>
        <span class="n">assertion_reference_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="n">signed_assertion_query</span><span class="p">)</span>

        <span class="k">if</span> <span class="ow">not</span> <span class="n">assertion_reference_nodes</span><span class="p">:</span>
            <span class="c"># Check if the message is signed</span>
            <span class="n">signed_message_query</span> <span class="o">=</span> <span class="s">&#39;/samlp:Response&#39;</span> <span class="o">+</span> <span class="n">signature_expr</span>
            <span class="n">message_reference_nodes</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="n">signed_message_query</span><span class="p">)</span>
            <span class="k">if</span> <span class="n">message_reference_nodes</span><span class="p">:</span>
                <span class="nb">id</span> <span class="o">=</span> <span class="n">message_reference_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;URI&#39;</span><span class="p">)</span>
                <span class="n">final_query</span> <span class="o">=</span> <span class="s">&quot;/samlp:Response[@ID=&#39;</span><span class="si">%s</span><span class="s">&#39;]/&quot;</span> <span class="o">%</span> <span class="nb">id</span><span class="p">[</span><span class="mi">1</span><span class="p">:]</span>
            <span class="k">else</span><span class="p">:</span>
                <span class="n">final_query</span> <span class="o">=</span> <span class="s">&quot;/samlp:Response/&quot;</span>
            <span class="n">final_query</span> <span class="o">+=</span> <span class="n">assertion_expr</span>
        <span class="k">else</span><span class="p">:</span>
            <span class="nb">id</span> <span class="o">=</span> <span class="n">assertion_reference_nodes</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s">&#39;URI&#39;</span><span class="p">)</span>
            <span class="n">final_query</span> <span class="o">=</span> <span class="s">&#39;/samlp:Response&#39;</span> <span class="o">+</span> <span class="n">assertion_expr</span> <span class="o">+</span> <span class="s">&quot;[@ID=&#39;</span><span class="si">%s</span><span class="s">&#39;]&quot;</span> <span class="o">%</span> <span class="nb">id</span><span class="p">[</span><span class="mi">1</span><span class="p">:]</span>
        <span class="n">final_query</span> <span class="o">+=</span> <span class="n">xpath_expr</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">__query</span><span class="p">(</span><span class="n">final_query</span><span class="p">)</span>

    <span class="k">def</span> <span class="nf">__query</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">query</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Extracts nodes that match the query from the Response</span>

<span class="sd">        :param query: Xpath Expresion</span>
<span class="sd">        :type query: String</span>

<span class="sd">        :returns: The queried nodes</span>
<span class="sd">        :rtype: list</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">encrypted</span><span class="p">:</span>
            <span class="n">document</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">decrypted_document</span>
        <span class="k">else</span><span class="p">:</span>
            <span class="n">document</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">document</span>
        <span class="k">return</span> <span class="n">OneLogin_Saml2_Utils</span><span class="o">.</span><span class="n">query</span><span class="p">(</span><span class="n">document</span><span class="p">,</span> <span class="n">query</span><span class="p">)</span>

    <span class="k">def</span> <span class="nf">__decrypt_assertion</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dom</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Decrypts the Assertion</span>

<span class="sd">        :raises: Exception if no private key available</span>
<span class="sd">        :param dom: Encrypted Assertion</span>
<span class="sd">        :type dom: Element</span>
<span class="sd">        :returns: Decrypted Assertion</span>
<span class="sd">        :rtype: Element</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">key</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">__settings</span><span class="o">.</span><span class="n">get_sp_key</span><span class="p">()</span>

        <span class="k">if</span> <span class="ow">not</span> <span class="n">key</span><span class="p">:</span>
            <span class="k">raise</span> <span class="ne">Exception</span><span class="p">(</span><span class="s">&#39;No private key available, check settings&#39;</span><span class="p">)</span>

        <span class="c"># TODO Study how decrypt assertion</span></div>
</pre></div>

          </div>
        </div>
      </div>
      <div class="sphinxsidebar">
        <div class="sphinxsidebarwrapper">
<div id="searchbox" style="display: none">
  <h3>Quick search</h3>
    <form class="search" action="../../search.html" method="get">
      <input type="text" name="q" />
      <input type="submit" value="Go" />
      <input type="hidden" name="check_keywords" value="yes" />
      <input type="hidden" name="area" value="default" />
    </form>
    <p class="searchtip" style="font-size: 90%">
    Enter search terms or a module, class or function name.
    </p>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
        </div>
      </div>
      <div class="clearer"></div>
    </div>
    <div class="related">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../../genindex.html" title="General Index"
             >index</a></li>
        <li class="right" >
          <a href="../../py-modindex.html" title="Python Class Index"
             >modules</a> |</li>
        <li><a href="../../index.html">SAML Python library classes and methods</a> &raquo;</li>
          <li><a href="../index.html" >Class code</a> &raquo;</li>
      </ul>
    </div>
    <div class="footer">
      Created using <a href="http://sphinx.pocoo.org/">Sphinx</a> 1.1.3.
    </div>
  </body>
</html>
